Privacy Policy

Last updated: June 26, 2026

I. Data controller

The controller of your personal data is INSERIO Sp. z o.o., registered at Al. Jerozolimskie 109/70, 02-011 Warsaw, Poland, entered in the National Court Register (KRS) under number 0001200576, tax identification number (NIP): 7011282419 (hereinafter “Controller” or “INSERIO”).

Contact for data protection matters: biuro@inserio.pl

II. Purposes and legal bases of data processing

The Controller processes your personal data for the following purposes:

1. Insurance intermediation and contract performance
Purpose: presenting insurance offers, concluding and servicing insurance contracts, conducting a needs and requirements analysis (APK).
Legal basis: Art. 6(1)(b) GDPR (contract performance), Art. 6(1)(c) GDPR (legal obligation under the Polish Insurance Distribution Act of December 15, 2017).

2. Health data processing
Purpose: assessing insurance risk for health insurance products (medical questionnaire).
Legal basis: Art. 9(2)(a) GDPR (explicit consent), Art. 9(2)(f) GDPR (establishment, exercise or defence of legal claims).

3. Legal obligations
Purpose: maintaining APK documentation, archiving, anti-money laundering (AML) compliance.
Legal basis: Art. 6(1)(c) GDPR.

4. Legitimate interest of the Controller
Purpose: handling inquiries and complaints, establishing or defending legal claims, analytics and service improvement.
Legal basis: Art. 6(1)(f) GDPR.

5. Marketing
Purpose: sending information about INSERIO products and services.
Legal basis: Art. 6(1)(a) GDPR (consent). Consent may be withdrawn at any time.

III. Categories of data processed

Depending on the processing purpose, the Controller may process:

  • identification data: first name, surname, PESEL (Polish ID number), date of birth, gender, citizenship, residence permit number,
  • contact data: residential address, email, phone number,
  • health data: information from medical questionnaires (only with explicit consent and to the extent necessary for insurance risk assessment),
  • insurance contract data: policy numbers, coverage scope, premiums, claims history,
  • technical data: IP address, browser identifier (user agent), cookies.

IV. Data recipients

Your personal data may be shared with:

  • insurance companies with which INSERIO cooperates (including Compensa TU S.A. Vienna Insurance Group and others),
  • CUK Ubezpieczenia Sp. z o.o. (multi-agency through which INSERIO performs agency activities),
  • IT service and hosting providers (OVH, France — within the EEA),
  • accounting and legal service providers,
  • public authorities as required by law (KNF, tax authorities).

V. Data transfers outside the European Economic Area (EEA)

Due to the use of certain service providers, your data may be transferred outside the EEA:

5.1. Google LLC (United States)
Services: Gmail, Google Drive, Google Sheets, Google Analytics.
Legal basis: European Commission Implementing Decision (EU) 2023/1795 of July 10, 2023 on the adequate level of protection under the EU-US Data Privacy Framework. Google LLC is a certified participant. Additionally: Standard Contractual Clauses (SCCs).

5.2. Telegram FZ-LLC (United Arab Emirates)
Services: client communication via the Telegram messenger.
Legal basis: Art. 49(1)(a) GDPR — explicit consent of the data subject, given at first contact via the messenger, after prior information about the risks of such transfer. The European Commission has not issued an adequacy decision for the UAE under Art. 45 GDPR. Alternative communication channel: email (biuro@inserio.pl), phone (+48 664 298 945).

5.3. WhatsApp (Meta Platforms, Inc., United States)
Services: client communication via the WhatsApp messenger.
Legal basis: European Commission Implementing Decision (EU) 2023/1795 (EU-US Data Privacy Framework), Standard Contractual Clauses (SCCs). Alternative communication channel: email (biuro@inserio.pl), phone (+48 664 298 945).

VI. Data retention periods

  • Insurance contract data: for the duration of the contract and 10 years after its termination (statute of limitations for claims).
  • APK documentation: at least 3 years from the date of the analysis (requirement under the Insurance Distribution Act).
  • Data processed on the basis of consent: until consent is withdrawn.
  • Data processed for marketing purposes: until consent is withdrawn or an objection is filed.
  • Cookies and technical data: according to browser settings, no longer than 12 months.

VII. Your rights

Under the GDPR, you have the following rights:

  • right of access (Art. 15),
  • right to rectification (Art. 16),
  • right to erasure — “right to be forgotten” (Art. 17),
  • right to restriction of processing (Art. 18),
  • right to data portability (Art. 20),
  • right to object to processing based on legitimate interest (Art. 21),
  • right to withdraw consent at any time (Art. 7(3)) — withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise these rights, contact us at: biuro@inserio.pl

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, www.uodo.gov.pl.

VIII. Cookies

The website inserio.pl uses cookies for:

  • essential website operation (session cookies, language preferences),
  • analytics (Google Analytics — with your consent),
  • marketing (with your consent).

Detailed cookie information and consent management are available in the cookie banner displayed on your first visit.

IX. External website redirects

The website inserio.pl contains links to calculators and purchase forms of insurance companies. When you click “Buy online” or a similar button, you leave inserio.pl and are redirected to the insurance company’s website. The processing of personal data on the insurance company’s website is governed by its own privacy policy.

X. Voluntary nature of data provision

Providing personal data is voluntary but necessary for concluding an insurance contract and providing intermediation services. Failure to provide data will prevent the provision of these services. Providing health data requires explicit consent.

XI. Changes to this privacy policy

The Controller reserves the right to update this policy. Significant changes will be communicated through the website.